In this articleShow
Short answer: Credential stuffing is when attackers take email-and-password pairs leaked in one data breach and automatically try them on thousands of other websites. It works because people reuse passwords. It is not a clever hack — it is automation exploiting a habit — and it is almost completely preventable: use a unique password for every account (a password manager makes this effortless) and turn on two-factor authentication or passkeys for important accounts.
How a credential stuffing attack works
- A site gets breached. Attackers steal or buy a list of email addresses and passwords. Billions of these combinations circulate in breach collections — Have I Been Pwned alone tracks well over ten billion breached accounts.
- The list is loaded into automated tools. Attackers use software that can try credentials against many sites at once, rotating through large pools of IP addresses so they look like ordinary users.
- They try every pair on popular services — email, shopping, streaming, banking, gaming, social media.
- A small percentage work. Even a 0.1–2% success rate is profitable when the list has millions of entries.
- Working logins are used or sold — to drain gift-card and loyalty balances, make purchases with saved cards, take over email to reset other passwords, or resell access.
Why it matters more than people think
Stolen credentials remain one of the most common ways into accounts and companies. Verizon's 2026 Data Breach Investigations Report found credential abuse somewhere in the attack chain of 39% of breaches, and reported that half of ransomware victims that had previously leaked credentials had that leak within the 95 days before the attack. When one reused password protects your email, the attacker can reset almost everything else.
Credential stuffing vs. other password attacks
Attack | How it works | What stops it |
|---|---|---|
Credential stuffing | Reuses real leaked username/password pairs on other sites | Unique passwords, 2FA/passkeys |
Password spraying | Tries a few common passwords ("Summer2026!") against many accounts | Strong passwords, 2FA, lockout policies |
Brute force | Tries every possible combination against one account | Long passwords, rate limiting, 2FA |
Phishing | Tricks you into typing your password on a fake site | Passkeys, password managers that won't autofill on fake sites |
Signs you've been hit
- Login alerts or "new device" emails you don't recognize.
- Password-reset emails you didn't request.
- Orders, loyalty-point redemptions or messages you didn't make.
- Being logged out of a service unexpectedly.
- Your email appearing in a breach at Have I Been Pwned.
How to protect yourself (in 30 minutes)
- Check your exposure. Search your email addresses on Have I Been Pwned and sign up for its free alerts.
- Install a password manager. Bitwarden is free; 1Password is the most polished. Let it generate long random passwords.
- Change reused passwords, starting with the most important accounts: email first (it can reset everything else), then banking, your password manager's master password, mobile carrier, and shopping sites with saved cards.
- Turn on two-factor authentication for those same accounts — ideally with passkeys or an authenticator app rather than SMS.
- Check any password you plan to keep with a k-anonymity checker like our Pwned Password Checker, which never sends your actual password.
Treat any password you've used on more than one site as already compromised.
How businesses defend against credential stuffing
If you run a website or app, your users' reused passwords become your problem:
- Offer passkeys and MFA, and require MFA for administrators.
- Screen new passwords against breach lists (Have I Been Pwned's Pwned Passwords API is free).
- Rate-limit and monitor login attempts by IP, account and device fingerprint; watch for spikes in failed logins across many accounts.
- Use bot detection at the login page through your WAF or CDN.
- Alert users about new-device logins and suspicious resets.
Frequently asked questions
Is credential stuffing illegal?
Yes. Using stolen credentials to access accounts is unauthorized access under computer-crime laws in the US, UK, EU and most other countries.
Does a strong password protect me from credential stuffing?
Only if it's unique. A very strong password reused on a breached site is just as exposed as a weak one.
Will two-factor authentication stop credential stuffing?
It stops most attempts, because the attacker has the password but not your second factor. Passkeys and authenticator apps are stronger than SMS codes.
Sources
- Verizon, 2026 Data Breach Investigations Report — via Help Net Security's summary and Flare's analysis
- Have I Been Pwned, Pwned Passwords
- OWASP, Credential stuffing prevention cheat sheet
